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ABSTRACT 


Video cameras are a large part of today’s mainstream society, where many 
people feel the need to record and share their life’s experiences. YouTube, created in 
2007, has become the most popular host of Internet videos from around the world 
with an estimated 1 billion unique monthly users (Youtube.com). YouTube 15 
localized in 61 countries and across 61 languages. Over 100 hours of video are 
uploaded every minute. These videos can contain important information about a 
crime, or event, that might have occurred. For example, in September of 2014, the 
terrorist group called ISIS released a set of videos on YouTube that portrayed the 
beheadings of American and British citizens. These videos were called into question, 
and their authenticity needed to be determined. It is the job of the forensic 
investigator to determine if a particular video, in question, is a complete and accurate 
representation of what it purports to be. 

This research paper will address the effects of YouTube on source camera 
identification while seeking to quantify the amount of change that can occur during 
the conversion process. It is well understood that YouTube re-encodes all video 
uploaded to the site, which has several implications for forensic authentication 


analysis [1]. The testing material described in this paper was comprised of 11 


different cameras and three different downloader tools. Chapter 1 describes a variety 
of established image authentication techniques used to determine the origin of a 
video. Chapter 2 describes the underlying framework of YouTube, how it works, and 
the effects it can have on video. Chapter 3 describes and compares three tools that can 
be used for downloading YouTube videos. Chapter 4 describes how the test data was 
acquired. Chapter 5 addresses structure and source identification techniques using the 
test results. Chapter 6 describes all conclusions reached during analysis. Chapter 7 


ends with future research in the field. 


The form and content of this abstract are approved. I recommend its publication. 
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CHAPTER І 


INTRODUCTION 


Recent advancements in digital imaging technology have allowed users to 
easily create video through the use of smartphones, tablets and other mobile devices. 
The desire for people to share their videos online has been supported by different 
online social media websites. 

As these videos are shared on the Internet, it can become extremely difficult to 
determine the origin of a video in an event that a crime has been committed. 
Recorded video of any illegal activity has a unique ability to serve as evidence, if 
determined to be consistent with an authentic recording or, in piracy cases, the video 
itself can be illegal in its creation and possession. 

Digital camera identification is the process of linking images to a source 
camera. A reliable method to identify a source camera from other possible cameras 
can help assist in the authentication process significantly in a case that involves 
piracy, child pornography, or espionage. Camera identification methods include, but 
are not limited to: defective pixel analysis, sensor dust analysis, photo response non 
uniformity (PRNU), file structure analysis, metadata analysis, and identification 
based on color filter array (CFA). The research in this study briefly discusses these 
methods then focuses on structure, metadata and PRNU for the study. 

Defective Pixel Analysis 
When an imaging sensor in a digital camera fails to sense the light levels of a 


scene correctly it is known as a defective pixel. A defective pixel can leave traces in 


every image generated by a digital camera. Therefore, this technique can be used as a 
unique camera identifier [1]. Upon acquisition of the image, the location of a 
defective pixel will be identical in subsequent images. This method is very limited 
since a unique pixel defect can be corrected after image acquisition in the integrated 
post-processing stage. As advancements in technology continue to develop, this 
method has become less relevant in camera authentication as the chances of having a 
defective pixel in question are extremely rare. 
Sensor Dust Analysis 

The lenses on DSLR cameras are interchangeable and, upon the removal of the 
camera lens, the sensor is exposed to hazards such as dust and moisture. The particles 
are attracted to the imaging sensor by electrostatic fields. Once the dust settles onto 
the senor it creates a pattern. Sensor dust patterns are displayed as artifacts on the 
captured images and they become largely visible at smaller aperture values [2]. 
Normally, this unique dust pattern is not changed unless the sensor surface is cleaned. 
Therefore, it can be used to match a given image to a source DSLR camera. This 
method is very limited, as with defective pixels, but should be noted as a possible 
source identification technique. 

Color Filter Array Analysis 

Another method in camera identification uses the color filter array. The CFA is 
a mosaic of tiny color filters placed over the matrix (pixel sensor) of an image sensor 
to capture color information. Most state-of-the-art digital cameras employ a single 
mosaic structured CFA to cut costs rather than having different filters for each color 


component. [3] As a consequence, each pixel in the image has only one color 


component associated with it. In order to obtain the missing color, each digital 
camera employs a proprietary interpolation algorithm. This introduces a specific 
statistical periodic correlation between subsets of pixels, per color channel [4]. This 
can be estimated as a digital signature of a camera model. When a JPEG image is 
re-saved with an image editor, the original CFA correlation is changed as well. A 
CFA analysis can reveal inconsistencies with an original JPEG and/or indicate traces 
of image recompression. 

Photo Response Non Uniformity Analysis 

Photo-response non-uniformity (PRNU) is a tool that makes use of pixel 
identification and can be used as a unique tool in identifying the “fingerprint” of 
digital sensors. In theory, when uniform light falls on a camera sensor, each pixel 
should output exactly the same value, or an ideal uniform response. The differing 
sensitivity of individual pixels to the same amount of light is called PRNU [5]. This 
technique looks at the individual pixels that may report slightly lower or higher 
values than their neighbors, even when these pixels are illuminated uniformly. 

By extracting invisible sensor pattern noise from images left behind by the 
image sensor, a device signature or camera’s sensor fingerprint can be determined. 
The ability to extract the signal is affected by the quality of the sensor, the amount of 
light interacting with the sensor, and the scene content. Cell phones and lower-priced 
cameras are more susceptible to the defects of the sensor components than higher end 
model cameras. Every sensor has its own unique pattern due to the manufacturing 
processes. Small variations in a sensor’s cell size and material result in slightly 


different output values per cell. When two patterns show a strong level of similarity, 


it is an indication that the images might have come from the same camera. Extensive 
research has been done to establish the best type of filter and algorithm for effectively 
extracting the noise from the image in a timely manner. Currently, wavlet based de- 
noising is typically used for PRNU extraction [6]. 

Combinations of adaptive and median filtering strategies have also shown to 
be effective [7]. While the research continues to develop a more advanced PRNU 
extraction method this paper uses the median filtering extraction method, which has 
proven to be reliable. Median filtering is a nonlinear operation often used in image 
processing to reduce "salt and pepper" noise. A median filter is more effective than 
convolution when the goal is to simultaneously reduce noise and preserve edges 
(mathworks.com). Figure 1 displays the effects a median filter can have on a noisy 


image. 


Figure 1 —Median filtering to reduce “salt and pepper noise.” 


(mathworks.com) 


De-noising algorithms generally have troubles discriminating between true 


noise and small details. It is important to select an appropriate filter that leaves the 


http://www.mathworks.com/help/images/ref/medfilt2.html A 


image structure in tact, most notably around edges where the local variance is high. 
Structure Analysis 
All digital cameras create files in a particular way, each with its own unique 
structure. It is important to understand that when an image file is created, a huge 
surplus of information is carried along with it. This information is needed in order for 
computers and other devices to recognize and process the contents of the file. 


Figure 2 shows some of the information that is stored within a video container file. 


Format Container: .avi, .mp4, .mov, .ogg, .flv, .mkv, екс. 


Video codec: || Audio codec: | | Captioning, Metadata: 
Video description: 

Author, 
Н.264, DAE SAMI, SMIL, Title, 
VC-1, a Hi-Caption, Location, 
Theora, фа CMML, DXFP, || Date, 
Dirac 2.1, || РСМ, 3GPP TS 26.245, | | Copyright, 
H.263, etc. MPSub, ; License, 
etc. etc. etc. 


Figure 2- Container Structure 
An image file typically contains: the digital information about the image, a list 
of contents within the file, the location of the contents within the file, instructions on 


how to decode, then reassemble the physical image, and information about the file or 


container itself [8]. All this information is embedded into the image file and can be 
distinct between manufacturers and cameras. When computers, or image processing 
software interact with the file, this structure can be altered. While this type of 
alteration does not necessarily mean that image content itself has been altered, it can 
raise concern about the authenticity of the image 
Metadata Analysis 

Modern digital cameras may write EXIF (Exchangeable Image Format) or XMP 
(Extensible Metatdata Platform) metadata to the image. The EXIF data is embedded 
with the image in the header of the digital file. This metadata can contain tags such as 
date and time, camera settings, geographical locations, or the serial number of the 
camera that produced the image. Although metadata can prove to be very useful in 
camera identification, it can easily be deleted or manipulated. Social media websites 
may remove or alter metadata information to decrease file size and maintain user 
privacy [9]. A framework of specific authentication techniques that should be used by 
forensic investigators can be found by (Anderson, Scott, 2001). It is very important to 
know the limits of your tools and combine techniques when providing camera 


identification analysis. 


CHAPTER II 


YOUTUBE FRAMEWORK 


It is important to think of the files uploaded to YouTube as a master video that 
will be used as source material to generate various quality video streams at different 
resolutions. Simply stated, the better the quality of file that is uploaded, to YouTube, 
the better quality that will be received upon download. When uploading video to 
YouTube one of the following formats must be used in order for YouTube to 
recognize the video: MOV, .MPEG4, .MP4, .AVI, .WMV, .MPEGPS, .FLV, .3GPP, 
.WebM. 

Re-Encoding 

YouTube re-encodes all video uploaded to the site, which has several 
implications. First, there’s no value in trying to match YouTube's output to avoid re- 
encoding. The video will always re-encode regardless if the dimensions are identical 
upon upload and download [1]. This fact is significant and should not be overlooked 
when providing authentication analysis. 

Secondly, YouTube uses dynamic adaptive streaming over HTTP (DASH) for 
delivering videos. DASH is an adaptive bitrate streaming technique that enables high 
quality streaming of media content over the Internet delivered from conventional 
HTTP web servers (MPEG.ORG). Once video is uploaded to YouTube the content is 
made available at a variety of different bit rates and resolutions to prevent re- 
buffering during playback. The DASH format serves audio and video in two separate 


streams for some resolutions/formats including 1080p and 480p. 


Downloading 

It is important to understand the legal ramifications of downloading video from 
YouTube. In general, downloading videos that other people have posted on YouTube 
is not allowed. YouTube only provides an option to download MP4s of the user’s 
own videos. Consequently, this limits the extent of downloading capabilities by 
excluding other user’s videos. However, in a real world application, the video in 
question would be coming from an unknown source and this research is based upon 
that principle. 

Various YouTube downloading utilities were used in this study. These tools 
play an important role in acquiring the video used for authentication analysis. 
Fortunately, for the user, there are hundreds of freeware and software downloader 
tools available for Mac and PC. Most tools can easily download all available formats 
while others are restricted in downloading capabilities. 

Available Formats 

A list of available formats can be viewed using Exiftool. This tool works by 
reading the metadata from a source file on YouTube. The information is then printed 
out in a list form. This is one method to view the formats available upon download. 
Other tools, which are mentioned in the next chapter, work in a similar manner using 
metadata from the source file on YouTube. This research uses a 1080p resolution and 
an MP4 format for all videos upon uploading to the site. Figure 3 displays a list of the 
available downloading formats and resolutions that were available from the 1080p 


video. 


audio only DASH audio@128k (worst) 
144p DASH video only 
240p DASH video only 
360p DASH video only 
480p DASH video only 
720p DASH video only 
1089р DASH video only 
360p 3D 

360p 3D 

720p 3D 

176x144 

320x240 

400x240 

640х360 

640х360 

1280х720 (best) 


Figure 3 YouTube Resolution options for a 1080p upload. 


CHAPTER III 


DOWNLOADER TOOLS 


A downloader tool is any type of freeware, software, or command line script 
that allows the user to download video off the Internet. In this study, the tools must 
recognize the Dynamic Adaptive Streaming over HTTP (DASH) video hosted by 
YouTube’s server. 

It is not possible to acquire video from an unknown user on YouTube by 
simply clicking download from the host. Therefore, these tools are relevant and need 
to be validated and verified for accuracy and precision. A comprehensive list of 
validated downloading tools is currently unavailable and relatively unfeasible, 
considering the constant advancement of technology. It is not possible to verify and 
validate all the tools. That said, the focus of this study highlights the three most 
popular downloading tools at this time. 

It is important to understand that each tool acts like a “black box” when 
downloading video information from the host website. The user is unable to observe 
the inner workings or alterations that are occuring until the video output is obtained. 
Some tools work in the same way and output identical videos. 

It is understood that some type of recompression is occurring since the DASH 
format comes as two separate tracks, one for video and one for audio. However, it is 
difficult to determine what changes occur during this process due to the “black box” 
principle. It is crucial for an examiner to understand his or her tools as well as the 


effects they can have, during analysis, on a video that is being scrutinized. 
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It is recommended to avoid video capture programs that record a computers 
video display output (such as Cam Studio, Snag It, Video Capture, ect). These 
programs have poor analysis results due to the fact that what is played on the screen 
has the artifacts of the decoding and is not the original resolution. 

Real Player One 
Real player one (RPO) is a downloader tool developed by RealNetworks, Inc 
for Mac and PC. Recently, this program has changed to a cloud-based format. RPO 
works as an extension within an Internet browser. Once a video is recognized on the 
browser, RPO will provide the option to download the video displayed. Instead of 
providing the option of downloading different resolutions, it will download any 
resolution that is currently displayed at the time. In order to download a 1080p 


resolution video from YouTube, the user needs to display the video at 1080p under 


RealPlayer Cloud 
Version 1.0.1 (1.0.1.1) 


the quality settings on YouTube. 


Terms of Service and Privacy Policy 


Copyright © 1995-2014 RealNetworks, Inc. All 
Rights Reserved. 


Figure 4- RPO Version information 


YouTube Downloader 
YouTube Downloader version 2.0 (YTD) is a downloader tool developed by 


GreenTree Applications for both PC and MAC. This tool uses FFmpeg licensed under 
11 


the LGPLv3 and its source code can be easily downloaded and viewed. The following 
formats were available for download once the URL is recognized by YTD: HD 1080, 
HD 720p, HQ 480p, HQ 360p (flv), HQ 360p (mp4), 240p, and 144p. No other 


settings are necessary or available within this tool. All research videos downloaded 


using YTD were 1080p. 


Upgrade Now! 


Download | Activity | Play | 


Enter the URL of the video you want to download (e.g. http:/ /www.facebook.com/...) 
http://www.youtube.com/watch?v zaKjRIFfSPVI Paste URL | 
For multiple URLs до PRO! 
Download quality | 1080p Full HD x 
Save to = C: UserslStudentlDocuments 
я” Automatically convert to Ipad Video (MPEG-4 MP4) 
Conversion quality High 
Delete original file after conversion 
$ DOWNLOAD 


Figure 5- YTD User Interface 


ATube Catcher 
ATube Catcher version 3.8 is a freeware downloader tool developed by Diego 
Uscanga. This tool can be thought of as a small web browser that interprets the 
content and downloads the video in the directory selected. It then converts a video to 
the format requested. All formats created by YouTube were available for download 
within this tool. ATube catcher provides a large list of recompression options that 


should be avoided for research purposes. The “no recompression” option, displayed 


by figure 6, was used during this research. 
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(8) aTube Catcher 3.8.7980 - Studio Suite - DsNET Corp. 2014 


— | ет 58 


File Tools Profiles Help Video Search Tool 


Diego Uscanga (http://www atube те) 


Downloader Stream Catcher Screen Record Video Converter DVD/BluRay/CD Creator 
Enter in this box the full URL of your video: Paste 
URL del Video: “| Download 
Output profile [No Conversion (Only get original ве) z 
| Save To: CUsersiStudentlVideos Settings 


Title Status Size 
О Nikon Coolpix 59400 snCG CAM 179 m02 Completed 


Output profile 
2.6 MB No Conversion (Only get original file) 


Figure 6- aTube Catcher User Interface 


Your video is available in multiple formats, please choose one 


Source format Type 


Privacy Policy Rev. 7980 


Audio Recorder 


Video URL 
youtube.com/watch?vzXSEK... 


[z] 


.. 1920x1080 HD... application/octet... 


6.77 MB 


Nikon Coolpix 59400 snCG CAM... 
Nikon Coolpix $9400 snCG CAM... 
Nikon Coolpix 59400 snCG САМ... 
Nikon Coolpix 59400 snCG CAM... 
Nikon Coolpix 59400 snCG CAM... 
Nikon Coolpix 59400 snCG САМ... 
Nikon Coolpix 59400 snCG САМ... 


1 280x720/9/0/... 
1280x720/9/0/... 
640x360/99/0/... 
640х360/99/0/... 
640x360/9/0/1... 
640x360/9/0/1... 
426x240/7/0/0... 


2.64 MB 
2.19 MB 


video/mp4 

video/mp4 
video/webm 0.53 MB 
video/webm 0.47 MB 
0.76 MB 
0.67 MB 


0.52 uB № 


video/mp4 
video/mp4 
video/x-flv 


[E] Don't ask again 


Download (6) 


Figure 7- aTube Catcher Download Resolution Options 


Very little research has been published on YouTube compression effects and 
no research has been published, so far, on the tools or cameras used in this paper. A 


fellow student at the National Center for Media Forensics has done research in this 


area looking at cell phone images in social media websites [9]. His focus was 


determining the changes social media websites, such as MySpace and Facebook, had 


on the cell phone images. 
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Other Tools 

It was difficult to select three tools to implement during research due to the 
large population of tools widely available. Prior research was done to study the trends 
and ensure the tools selected were some of the most widely used. Over a dozen tools 
were tested before determining the best options. Some YouTube downloader tools 
may contain viruses upon download. This paper recommends having some form of 
anti virus software prior to downloading any tools to protect against a possible attack. 

Some of the tools that were studied, but not used, include Clip grab, МасХ, 
and a command line script tool called YouTube-dl. Unfortunately, Clip Grab 
encountered many consistent errors while trying to preform the download. Therefore, 
Clip Grab was not selected as one of the primary tools for research. 

МасХ is a tool designed for mac platforms. Тһе PRNU results of the МасХ 
downloader yielded identical results as YTD. Instead of repeating identical results, 
МасХ was not used as one of the three primary tools. This tool should be noted, 
however, as a high-quality tool for downloading video from YouTube, and the results 
mirrored YTD. 

A command line script, using brew called YouTube-dl, was also used in 
preliminary research. This script works well for some formats but would not allow a 
playable download of the 1080p resolution needed due to the DASH format used by 
YouTube. The youtube-dl script can be used as a tool for some YouTube videos but is 


not applicable in this research due to resolution limitations. 
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CHAPTER IV 


MATERIAL AND METHODS 


Data Base Acquisition 

The video camera database was collected using 10 Go Pro Hero black 
Edition’s and one Nikon Cool Pix S-9. Two videos were produced using each of the 
11 cameras. Each video has a time frame of roughly 15-20 seconds. Ideally, a large 
number of frames should be used to calculate the Photo Response Non-Uniformity 
All camera dimensions were set at 1920x1080p during recording. The codecs used to 
encode the videos were H.264, AAC. The color profile settings on all cameras used 
for research was HD (1-1-1). Figure 8 shows some of the cameras used for the 


experiment. 


Figure 8- Go-Pro Cameras 
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The research videos were produced in a controlled setting on a wall illuminated 
by florescent lighting. The wall was uniformly lit and painted a neutral, flat cream 
color. The controlled lighting conditions selected were ideal for extracting uniform 
images. Extra attention was given to ensure no shadows were cast on the image 
during acquisition, as this would hinder results. Figure 9 shows the color and texture 


of the wall used for research. 


Figure 9- Wall Color and Texture 


Database Upload and Download 
After the video data was acquired and saved, the entire collection of videos 
was uploaded to YouTube. This process was done using the uploading manager on 
the YouTube website. At this time there is no other way to upload videos to 
YouTube. During the uploading process, no special settings or inadvertent changes 


were made. Attention to detail is important during this process to ensure the correct 
16 


video is uploaded and titled accurately for proper download. 

By using three tools selected for analysis RPO, YTD and aTube Catcher, all 22 
videos were downloaded from each tool and saved. It was now possible to begin the 
experiment with three video sets, one from each of the tools, and the original set that 
was not uploaded to YouTube. 

Methods 

Structure analysis, metadata analysis, and PRNU analysis, was used to 
determine how well a source camera can be identified from the other videos collected. 
First, the changes found after the downloading process, within the structure and 
metadata of the video file, are discussed. Next, the structural and metadata analysis 
section describes the consistencies and changes that occurred during the uploading 
and downloading process. The PRNU analysis, described last, looks to reach a 
conclusion for camera identification with the YouTube videos. 

Structure 
To analyze the structure of the files a program called Medialnfo v0.7.69 was 
used. This program provides easy access to technical information about video and 
audio files. Each of the video files were reviewed in order to determine if any changes 
in size, structure, or information loss were present. 

During the structure analysis, a tool called Exiftool v9.72 was also used. This 
program is a command line application tool for reading, writing, and editing metadata 
information in a wide variety of files. This tool preforms well at reading the 
information within the metadata and pulling it out in a cohesive and organized format. 


Exiftool provided the most detailed information about the file structure. 
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Photo Response Non Uniformity 

A basic algorithm for linking a camera to an image can be described in a few 
simple steps. First, the camera reference patterns need to be calculated in order to 
develop a correlation between each of the patterns and the noise of an image [10]. 
The easiest way to calculate an approximation to the camera reference pattern is to 
average multiple images. Next, all frame averaging was done using a custom script in 
Matlab version 2012a. To speed up this process the scene content needs to be 
removed using a median filter de-noising algorithm. The noise residuals are then 
averaged. If a larger quantity of images is available to average, a greater suppression 
of random noise or scene content can be obtained. It has been suggested that a 
minimum of 50 images should be used for frame averaging [1]. 

After an established reference pattern has been created, a correlation can be 
determined with the noise of a particular image [10]. To find the random noise simply 
employ the same principal as before; Use the de-noising filter to approximate the 
noise-free image and subtract this from the original, leaving only the noise residual. 
To find the correlation between this noise n and a particular reference pattern r use 
the standard formula- 


corr (n,r)<(n-n).(r—r) 


In = nill[r — ril 


Every video from every camera, 22 total, were compared against each other 
using correlation coefficients (CC) to ultimately determine a possible conclusion for a 
source camera. This research was focused at looking for an inter variability and intra 


variability comparison. An inter variability comparison in this research uses two 
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videos created by different cameras. For example, a video from camera one would be 
compared against a video from camera three. This inter variability comparison uses 
all videos and all cameras against each other. This comparison is against others 
cameras and does not compare one camera against itself. Figure 10 Shows an 


example of an inter variability using Go-pro Cameras. 


Inter Variability 


Figure 10- Inter Variability 


An intra variability comparison, in this research, uses two videos created by the 
same camera. For example, a video from camera one would be compared against 
another video from camera one. This comparison is against a single camera and does 
not compare one camera against another. Figure 11 shows an example of an Inter 


variability comparison using Go-Pro Cameras. 
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Intra Variability 


Figure 11- Intra Variability 

These two terms will be used throughout the rest of this paper and are important 
to understand. This research compares the non-YouTube originals between 
themselves and against the others to study both the intra and inter variability before 
YouTube. The inter and intra variability was also tested for the downloaded videos 
that were acquired though each of the tools. 

If a frame-averaged image were compared and calculated for correlation 
against itself, the value of the correlation would be 1.0 meaning the images are 
identical. This exact match means that out of the three possible color channels (red, 
green, and blue) a perfect correlation of identical pixel noise was reported. When an 


image is compared, in correlation, to other frame averaged videos, taken from a 
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different camera, the value of the correlation coefficients would begin to drop. This 
drop is expected due to the fact that two different source cameras are being used. The 
lowest possible correlation that could theoretically be calculated would be a -1. This 
result would indicate that out of all possible pixel noise in each of the red, blue, and 


green channels not a single pixel displayed any identical properties. 
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CHAPTER V 


RESULTS 


Structure and Metadata Analysis 

The findings showed some very interesting differences between each of the 
downloader tools when given the exact same file to download off YouTube. 
Substantial differences in file size, file type, media duration, and movie data size, 
were present. A single randomly selected video from the data set was used during the 
structure analysis as an example to avoid redundancy. Video structure data for all the 
files can be found in the appendix (Section 1). The single video, randomly selected, 
gave an accurate representation of how the tools function when they encounter a 
video file regardless of length. Unique changes in video structure were also apparent 
between tools. 

The Hex information within the video file was re-encoded when the video was 
downloaded from Youtube using each of the three downloader tools. The original 
video file that was not uploaded to YouTube contained valuable information 
including camera model, serial number, and encoder information. This hex data, upon 
download, was replaced with hex information from each of the tools. Figure 12 


displays these changes: 
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Figure 12- Hex data comparison 
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Each column of hex information within figure 12 shows the data from the 


beginning of the video file. The original video file, displayed on the left side in figure 


12, contains valuable hex information that is highlighted in yellow. When comparing 


the original file to each of the three tools it is apparent that the hex information has 


been manipulated. Each tool replaced the information with its own unique hex 


structure and, consequently, the original camera information was lost. The camera 


information in this example included firmware, camera model, serial number, and 


gamma settings. An extensive list of information, from the camera, can be encoded 


within the hex. To the untrained eye, this hex information can look overwhelming and 
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impossible to understand. It is up to the examiner to learn the camera encoding 
structure and decipher the relevant data. 
Consistencies 

The results showed the file size and duration were consistent when YTD and 
RPO were compared against each other. These tools work in a very similar fashion 
since their results are nearly identical. The original video had a file size of 38MB 
before it was uploaded to YouTube. After the video was downloaded using RPO and 
YTD, the file size had changed to 4.8MB. A Tube reported a file size of 6.8MB upon 
download. A large amount of data loss occurred after the download, which was 
anticipated due to the compression scheme that YouTube uses. However, it was 
unexpected and interesting to see the differences between file size and media duration 
between the various tools. 

Other consistencies found included image dimensions and matrix structure. 
The file type was not converted to any other file format with one exception. RPO 
changed the file type in all videos to МАУ. The МАУ file format is an iTunes video 
format [11] and it is not understood why RPO changed specifically to this format. 

The tools preformed well at recognizing and downloading the correct 
1080x1920 version from YouTube. This is a crucial first step that cannot be 
overlooked during analysis. The Results were consistent amongst all tools when 
reporting the correct size of the videos. The matrix structure was not changed and was 
confirmed as identical to the original file. 

Inconsistencies 


The structure results that deviated from the originals included media duration 
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and movie data size. The original duration of the movie, randomly selected for file 
analysis, as a sample for the entire collection, had a time of 15.25s. This media 
duration changed when the video was downloaded from YouTube. All of the tools 
seemed to be adding time to the original file. ATube reported a video duration of 
15.33s which is .08s longer than the original. Both YTD and RPO displayed a 
duration time of 15.30s which is .05s longer than the original. Table 1 shows the data 


found within the selected sample video and the changes that occurred. 


Table 1-Video 1-1 Exif Data acquired using Exiftool version 9.72 


(Note-File Size, Data Size and Media Duration Inconsistencies) 


38 MB 4.8MB 4.8MB 6.8MB 
ni 
Image Width 1920 1920 1920 1920 

Image Height 1080 1080 1080 1080 

Video Frame 29.97 29.97 29.971 29.97 

Rate 


prm eue | (0001004 10001000 [10001000 [10001000 
Media 15.25 5 15.30 5 15.30 5 15.33 5 
Duration 


Movie Data 39289830 5039051 5039051 7166451 
Size 
1920x1080 1920x1080 1920x1080 1920x1080 


PRNU Analysis 


ata Type 


Ty, 


From the research in this paper, it is clear that YouTube degraded the PRNU 
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noise that was used to determine a source camera. This degradation and loss of PRNU 


noise was expected due to the compression scheme that YouTube uses. It was also 
apparent that the C.C values of the original videos were higher than those of any of 
the YouTube videos. 


Figure 2, 3, and 4 exhibit each of the tool’s inter variability results when 


compared to the originals. Figure 5 shows all of the inter variability results located on 


one plot for a reference. The YouTube videos, within figure 5, scattered roughly 


around the .03 CC mark. The aTube tool shows the largest range in values with some 


of the highest and lowest C.C values. The results from the downloaded YouTube 
videos, were well below those of the original videos which were densely scattered 
above the .10 C.C mark. Table 6, 7, and 8 exhibit each of the tool’s intra variability 
results when compared to the originals. Table 9 shows all of the intra variability 
results on one plot for a reference. Within Table 9 it is clear that the single Nikon 
camera used in the experiment has preformed very uniformly with all the other Go- 
Pro action cameras. The results from the aTube tool showed the highest level of 
correlation out of any of the tools. The correlation data from the group of tools 
populated dense results at the .5 mark. The original video correlation results 
populated heavily around the .3 mark. The highest value was determined to be the 
original GP-Camera 10 with a value of .53426. This was coincidentally the longest 
video which leads us to believe in future research a longer time frame, when 


acquiring video, could produce higher correlation values. 
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Correlation Coefficient 


Correlation Coefficient 


0.12 


Table 2- Inter Variability (YTD Vs. Original) 


Inter Variability Plot (YTD Vs. Original) 


Table 3- Inter Variability (aTube Vs. Original) 


Inter Variability Plot (aTube Vs. Original) 
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Table 4- Inter Variability (RPO Vs. Original) 
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Correlation Coefficient 


Inter Variability Plot (RPO Vs. Original) 


Table 5- Inter Variability (YTD, RPO, aTube, Vs. Original) 


Inter Yarability Plot YTD,RPO,aT ube, Original 
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Table 6- Intra Variability Plot (RPO Vs. Original) 
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Intra Variability Plot (RPO Vs. Original) 


GPC-1 GPC-2 GPC-3 GPC4 GPC-5 GPC-6 GPC-7 GPC-8 GPC-9 GPC-10 Nikon 
Cameras 


Table 7- Intra Variability Plot (aTube Vs. Original) 


Intra Variability Plot (aTube Vs. Original) 


O Ф O о n 
GPC-1 GPC-2 GPC-3 GPC-4 GPC-5 GPC-6 GPC-? GPC-8 GPC-9 GPC-10 Nikon 
Cameras 
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Correlation Coefficients 


Correlation Coefficient 


Table 8- Intra Variability (YTD Vs. Original) 


Intra Variability Plot (YTD Vs. Original) 


Original 


GPCI GPC-2 GPC-3 GPC4 GPC-5 GPC-6 GPC-? GPC-8 GPC-9 GPC-10 Nikon 
Cameras 


Table 9- Intra Variability (aTube, YTD, RPO, Vs. Original) 


Intra Variability Plot (aT ube, YTD, RPO, Original, 


GPC-l GPC-2 GPC3 GPC4 GPC-5 GPC.6 GPC? GPC.8 GPC9 GPC-10 Nikon 
Cameras 
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The mean correlation values of the original videos were determined to be 
higher than those of any of the tools. This was expected since a significant data loss 
after all YouTube downloads would cause degradation of quality and extractable 
noise. Table 10 shows a plot of the intra and inter variability when all correlation 
values were averaged for each of the three tools and the original. 


Table 10- Mean Correlation Values 


Mean С.С Inter Vs. Intra Yariability 


Bl nus variability 


Ф сеа, 


Mean C.C 


Original YTD RPO aTUBe 
Cameras 


The intra variability PRNU results show a clear threshold of separation 
where a consistent video, an inconclusive video, and an inconsistent video can be 
determined using a histogram plot. The histogram plot demonstrates how to 
determine if an intra variability comparison of a camera in question is consistent, 
inconclusive, or inconsistent with an original or compressed video from YouTube. 


Histogram tables 11, 12, and 13 show an inconclusive area of separation using a black 
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circle. YTD, RPO and aTube each show a clear area of intra variability camera 
separation. 

If a camera’s correlation value were to fall within this black area of 
separation the result would be inconclusive. If the correlation value were to fall below 
the inconclusive area of separation, the result would be consistent with YouTube 
compression. Additionally, a video in question can be determined to be an original 
video, if the threshold of the correlation is above the inconclusive area of separation. 

Table 11- Histogram (Intra Variability Original Vs. YTD) 


Area of Separation (.063971 to .22584) 


Histogram (Intra Variability Original Vs. YTD} 


m IntraV YTD 
| | Intra¥ Onginal 


Inconclusive 
Area of 
Separation 
063971 to 
22584 


Cameras 


0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 
Correlation Coefficients 
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Cameras 


Table 12- Histogram (Intra Variability Original Vs. RPO) 


Area of separation (.08466 to .22584) 
Histogram (Intra Variability Original Vs. RPO) 


IntraV RPO 


IntraV Original 


Inconclustve 


Area of 


Separation 
22584 to 
08466 


0.1 0.2 0.3 0.4 0.5 0.6 
Conrleation Coefficients 


0.7 
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Table 13- Histogram (Intra Variability Original Vs. aTube) 


Area of Separation (.093963 to .22584) 


Histogram (Intra Variability Original Vs. aT ube) 


IntraV aT ube 


IntraV Original 


Inconclusive 
area of 


Cameras 


Separation 
32584 
to 093963 


0.3 0.4 
Correlation Coefficients 


The inter variability PRNU results do not exhibit any clear threshold of 
separation where an inconclusive video would fall. The results were interlaced within 
each other and no threshold was apparent. For inter variability, if a camera’s 


correlation value were to be significantly higher than the “grey” area, where the 
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correlations are interlaced, a verbal decision can be reached as being consistent with 
an original uncompressed, video. 

On the other side of the histogram if a camera’s correlation value were to be 
significantly lower than the “grey” area, where the correlations are interlaced, a 
verbal decision could be reached as being inconsistent with an original, uncompressed 
video. 

Table 14-Histogram (Inter Variability Original Vs. YTD) 


No clear separation is present 


Histogram (Inter Variability Original Vs. YTD 


ЩЕ Inter¥ YTD 
Ni Inter Original 


No Clear 
Separation is 
Present 


Cameras 


0 0.02 0.04 0.06 0.08 0.1 0.12 


Correlation Coefficients 
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Table 15- Histogram (Inter Variability Original Vs. RPO) 


(No clear separation is present) 


Histogram (Inter Variability Original Vs. RPO) 


СТІ Inter RPO 
EH Inter Original 


No Clear Area of 
Separation is 
Present 


Cameras 


0 0.02 0.04 0.06 0.08 0.1 0.12 


Correlation Coefficients 
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Table 16- Histogram (Inter Variability Original Vs. aTube) 


(No clear separation is present) 


Histogram (Inter Variability Original Vs. aT ube) 


a Inter aT ube 
aM Inter Original 


No Clear Area of 


Separation is 
Present 


Carneras 


0 0.02 0.04 0.06 0.08 0.1 0.12 


Correlation Coefficients 
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CHAPTER VI 


CONCLUSION 


The first conclusion reached from analysis showed that the downloader tools 
affect the PRNU measurements. This conclusion is also supported by the file sizes 
from table 1. A higher compression ratio for YTD and RPO was present due to the 
fact that an identical number of frames per second reported a lower file size than 
aTube. The high frequency small details were lost when large compression ratios 
were present. This compression can degrade the PRNU data and the discrimination 
power of the analysis. 

The research demonstrated that when downloading videos from YouTube for 
analysis, one should test their downloading tools and select the method which will 
incorporate the least amount of compression. 

If a video is called into question, and a reference video database is available, 
the examiner can look for a match. In a forensic case, it is recommend to a build 
database collected over time, with thousands of cameras and videos, to help 
determine the origin of a video. Since a reference population was available in this 
research, a threshold and a conclusion can be determined. This is the same principle 
that should be applied in all forensic cases. 

The results suggest that using a combination of techniques including format, 
structure, and PRNU will yield the most accurate results. PRNU can be relied upon 
when the structure analysis exhibits signs of change. In any video forensic case, an 


examiner should build a sample database, and calibrate all system’s before forensic 
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analysis. It’s very important to know the limits of your science and combine 
techniques when providing camera identification and authentication analysis. 

The techniques discussed in this paper are limited in providing positive proof 
of camera identification since the number of possible combinations between cameras, 
their settings, and eventually digital edits and recompressions before uploading to 
YouTube or other video hosting services is almost impossible to compute. Due to the 
number of different variables, the following conclusions are proposed that can be 


used within a framework for forensic cases: 


-Consistent with an authentic video... 
-Inconclusive... 


-Inconsistent with an authentic video... 


A conclusion in a forensic case contains the forensic results obtained by the 
examiner. Reporting the results in a clear and concise manner is crucial in conveying 
the report during legal proceedings. Table 17 was created to show an example of a 
basic conceptual structure for video authentication. The table is divided into three 
main sections: file structure, global structure analysis, and source camera 
identification. Within each of these sections the authentication and identification 
techniques listed can be removed, replaced, or built upon. Using all analysis 
techniques, listed in table 17, might not be practical or even feasible for an examiner 


due to time constraints or financial resources. It is up to the judgment of the 
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examiner to determine what techniques are necessary to provide a logical and 
unbiased conclusion as to the authentication or source of the video in question. 


Table 17- Proposed Structure 
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CHAPTER VII 


FURTHER RESEARCH 


New action cameras are constantly being developed. Since the publication of 
this paper the developers at Go-Pro have come out with the newest line of action 
cameras. Further research into action camera identification, using YouTube, should 
include this line of cameras and others that become relevant. 

New Video sharing hosts will inevitably be created for distributing video. 
Although YouTube is currently the most popular video sharing web service, other 
websites like Vimeo are gaining huge popularity. News organizations are also now 
sharing their video content over the Internet through their website. 

New resolutions will become relevant as action cameras currently allow 
acquisition of 4k and 8k videos. A higher resolution video with would improve 
PRNU results given the same lighting conditions. The structure of the video files 
along with the principles of acquisition and saving should generally remain the same 
while resolution improves. 

New downloader tools will be available in the future and will become relevant 
to acquire a video in question. These tools will work with new hosting websites to 
allow users the option to save higher resolution videos. YouTube has not created the 
option to download any video as of 2014. 

Other algorithms to extract PRNU noise (e.g Wavelet) should be tested and 
used in further experimentation. Combinations of algorithms have proven to be 


effective and should be tested on action cameras [7]. New or updated algorithms will 
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be developed that will process data more efficiently and allow for even higher 


correlation values. 
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APPENDIX 


Section 1- File Structure for all Videos 


4 | Сатеаттј | | 
| Information | Original | ҮП | ЕРО |  aTube | 


39289830 5039051 5039051 7166451 
Size 


| Camera? [| | | 
| Information | Original | ҮП | ЕО |  aTube | 


Image Height 1080 1080 1080 1080 
29.97 29.97 29.97 29.97 
16.98 s 17.04s 17.04 s 17.07s 


43717774 5554012 5554012 7972646 
Size 


ба | | 
| Information | Original | — YTD | ЕРО |  aTube | 


39736173 4999733 4999733 7232631 
Size 


44 


|. ] Camera2-2 | | | 
| Information | Original | — YTD | ЕО |  aTube | 


38255882 4747095 4747095 6947857 
Size 


—_-— w Re) EE | SSS 
| Information | Original | — YTD | ЕО |  aTube | 


Image Height 1080 1080 1080 1080 
29.97 29.97 29.97 29.97 
17.15 $ 17.205 17.20 s 17.23 $ 


44062209 5687497 5687497 8070707 
$17е 


ES WS Ketek | | 
| Information | Original | YTD | ЕО |  aTube | 


и 37280960 | 4645405 4645405 6795142 


Size 


45 


| Camma£l| | | 
YTD | RPO |  aTube | 


28240322 3559080 3559080 5121068 
Size 


| Camera? | | | 
| Information | Original |  YTD | ЕО |  aTube | 


34 MB 4.5 MB 4.5 MB 6.2 MB 


36031905 4731901 4731901 6527835 
Size 


| [camerasl |  — | 
| Information | Original | YTD | ЕО |  aTube | 


48811178 6108459 6108459 8935926 
Size 


46 


|. ] Camera -2 | | | 
YTD | RPO |  aTube | 


42301985 5392419 5392419 7766282 
Size 


бам | | 
YTD |  RPO |  aTube | 


Image Height 1080 1080 1080 1080 
29.97 29.97 29.97 29.97 
17.25 s 17.305 17.305 17.32 s 


44276724 5487463 5487463 8116226 
Size 


INN — — | | 
YTD | RPO |  aTube | 


34724321 4288379 4288379 6383676 
Size 


47 


| Camera7-i | | | 
YTD | RPO |  aTube | 


33603400 4292800 4292800 6119916 
Size 


MD ee — — | | 
YTD |  RPO |  aTube | 


Image Height 1080 1080 1080 1080 
29.97 29.97 29.97 29.97 
14.61 5 14.67 5 14.67 5 14.70 5 


37702498 4743947 4743947 6910318 
$17е 


pT Сатеавтј | | 
YTD | RPO |  aTube | 


37897629 4781548 4781548 6909869 
Size 


48 


ба | 
YTD | RPO |  aTube | 


37959174 4757307 4757307 6958366 
Size 


| Олтам| |): | 
YID | RPO |  aTube | 


38598176 4688087 4688087 7070215 
Size 


pT K VE | |. | 
YTD | RPO |  aTube | 


35939341 4464201 4464201 6565152 
Size 


49 


x  ] — Camera ton | | | 
YTD | RPO |  aTube | 


93709849 7890852 7890852 9316208 
Size 


|. | [Caneral2 |) | 
YTD | RPO |  aTube | 


Image Height 1080 1080 1080 1080 
23.976 23.976 23.976 23.976 
22.98 s 23.03 s 23.03 s 23.06 s 


87936948 7062568 7062568 9839232 
Size 


Camera 
YTD | RPO | arb | 


40041284 6639946 6639946 8767773 
Size 


50 


Camera 
YTD | RPO |  aTube | 


Image Height 1080 1080 1080 1080 
29.97 29.97 29.97 29.97 
23.02 s 23.08 s 23.08 s 23.10s 


43894492 7446439 7446439 9641933 
Size 


51 


